An application has a severe vulnerability, but strong compensating controls may block the attack path. What should the assessor evaluate?

1. Automatic risk closure without evidence
2. Only the vulnerability's publicity
3. The control's purchase price as proof of effectiveness
4. The controls' actual effectiveness and the remaining likelihood and impact